mirror of
https://gitlab.freedesktop.org/pipewire/pipewire.git
synced 2026-04-30 06:46:49 -04:00
a12cc84df4
Memory Safety: High The read_arbitrary() bounds check used `m->offset + len > m->length` where len is an attacker-controlled uint32_t read from the PulseAudio protocol message. When m->offset is small and len is close to UINT32_MAX, the addition wraps around to a small value, bypassing the bounds check. This allows read_arbitrary() to return a pointer within the message buffer but report an enormous length to the caller, leading to out-of-bounds memory reads. Fixed by rearranging the arithmetic to use subtraction: `len > m->length - m->offset`, which cannot overflow since m->offset <= m->length is maintained as an invariant. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| daemon | ||
| examples | ||
| gst | ||
| modules | ||
| pipewire | ||
| tests | ||
| tools | ||
| meson.build | ||